Information Security - 2

Other Registers EFLAGS – 32 Bit Register CFPFAFZFSFTFIFDFOFIO PL IO PL NTRFVM Bits 1,3,5,15,22-31 are RESERVED. 18: AC, 19:VIF, 20: VIP, 21:ID

Details of the flags CF – Carry Flag – Set by arithmetic instructions that generate a carry or borrow. Also can be set, inverted and cleared with the STC, CLC or CMC instructions respectively. PF – Parity Flag – Set by most instructions if the least significant eight bits of the destination operand contain an even number of 1 bits.

Details of the flags AF – Auxiliary Flag – If a carry or borrow from the most significant nibble of the least significant byte – Aids BCD arithmetic ZF – Zero Flag – Set by most instructions if the result of the arithmetic operation is zero

Details of the flags SF – Sign Flag – On signed operands, this tells whether the result is positive or negative TF – Trace Flag – On being set it allows single-step through programs. Executes exactly one instruction and generates an internal exception 1 (debug fault)

Details of the flags IF – Interrupt Flag – When set, the processor recognizes the external hardware interrupts on INTR pin. On clearing, anyway has not effect on NMI (external non maskable interrupt) pin or internally generated faults, exceptions, traps etc. This flag can be set and cleared using the STI and CLI instructions respectively DF – Direction Flag – Specifically for string instructions. DF = 1 increments ESI and EDI, while DF = 0 decrements the same. Set and cleared by STD and CLD instructions

Details of the flags OF – Overflow Flag – Most arithmetic instructions set this flag to indicate that the result was at least 1 bit too large to fit in the destination IOPL – Input Output Privilege Level flags – For protected mode operations – indicates the privilege level, 0 to 3, at which your code must be running in order to execute any I/O-related instructions

Details of the flags NT – Nested Task Flag – When set, it indicates that one system task has invoked another through a CALL instruction as opposed to a JMP. For multitasking this can be manipulated to our advantage RF – Resume Flag – It is related to Debug registers DR6 and DR7. By setting this, you can selectively mask some exceptions while you are debugging code

Details of the flags VM – Virtual 8086 mode flag – When it is set, the x86 processor is basically converted into a high- speed 8086 processor. AC (bit 18) Alignment check flag — Set this flag and the AM bit in the CR0 register to – enable alignment checking of memory references; clear the AC flag and/or the – AM bit to disable alignment checking. VIF (bit 19) Virtual interrupt flag — Virtual image of the IF flag. Used in conjunction – with the VIP flag. (To use this flag and the VIP flag the virtual mode extensions – are enabled by setting the VME flag in control register CR4.)

Details of the flags VIP (bit 20) Virtual interrupt pending flag — Set to indicate that an interrupt is pending; – clear when no interrupt is pending. (Software sets and clears this flag; the – processor only reads it.) Used in conjunction with the VIF flag. ID (bit 21) Identification flag — The ability of a program to set or clear this flag indicates – support for the CPUID instruction.

Protected Mode Registers LDTR – Local Descriptor Table Register – 16 bits GDTR – Global Descriptor Table Register – 48 bits IDTR – Interrupt Descriptor Table Register – 48 bits TR – Task register – 16 bits

Other System Registers Control – CR0, CR2, CR3 (each 32-bits) – CR0 is very important Bit 0 – PE bit – when set processor in protected mode else real mode Bit 3 – TS bit – The processor sets this bit automatically every time it performs a task switch. This can be cleared using a CLTS instruction Bit 31 – PG bit – when set paging MMU is enabled else it is disabled

Other System Registers Control – CR0, CR2, CR3 (each 32-bits) – CR2 – Read only register – deposits the last 32-bit linear address that caused a page-fault – CR3 – Stores the physical address of the PDB – Page Directory Base register. The paging tables are to be 4KB aligned and hence the 12 least significant bits are not stored and ignored

Other System Registers Debug Registers – DR0, DR1, DR2, DR3, DR6, DR7 – DR0-DR3 can hold four linear address breakpoints so that of the processor generates these addresses a debug exception (Interrupt 1) is caused – DR6 – Debug status register indicating the circumstances that may have caused the last debug fault – DR7 – Debug control register. By filling in the various fields of this register, you can control the operation of the four linear address breakpoints

Other System Registers Test Registers – TR6 and TR7 – Used to perform confidence checking on the paging MMU’s Translation Lookaside Buffer (TLB).

End of Session-9 Thank You